#include <windows.h>
#include <stdio.h>
#include <string>
#include <Tlhelp32.h>
#include <vector>
#include <Psapi.h>


#pragma comment (lib,"psapi.lib");

char shellcode[]={
"\x6A\x00\x6A\xFF\xE8\x01\x00\x00\x00\xC3\xB8\x01\x01\x00\x00\xE8\x01\x00\x00\x00\xC3\x8B\xD4\x0F\x34\xC3"};
DWORD shellcode_size=0x20;
DWORD syscall_number_offset=0x0B;
/*
PUSH 0
PUSH -1
CALL TERM
RET
TERM:
MOV EAX,101h
CALL SYS
SYS:
MOV EDX,ESP
SYSENTER 
RET
*/


typedef DWORD (__stdcall *CSRPID)(void);
typedef DWORD (__stdcall *NTQSI)(ULONG SystemInformationClass,PVOID SystemInformation,ULONG SystemInformationLength, ULONG* ReturnLength);
#define SystemHandleInformation 16

typedef struct {
    ULONG OwnerPid;
    BYTE ObjectType;
    BYTE HandleFlags;
    USHORT HandleValue;
    PVOID ObjectPointer;
    ACCESS_MASK GrantedAccess;
} SYSTEM_HANDLE_ENTRY;

typedef struct {
    ULONG HandleCount;
    SYSTEM_HANDLE_ENTRY Handles[1];
} SYSTEM_HANDLE_INFORMATION;





HANDLE OpenProcessFromDebug(DWORD pid)
{
if(DebugActiveProcess(pid)!=0)
{
DEBUG_EVENT DebugEvent;
while(1)
{
if(WaitForDebugEvent(&DebugEvent, INFINITE))
{
DebugActiveProcessStop(pid);
return DebugEvent.u.CreateProcessInfo.hProcess;
}
}
}
return 0;
}



HANDLE OpenProcessFromCsrss(DWORD pid)
{
       
        HMODULE ntdll = GetModuleHandle("ntdll");
        
                CSRPID CsrGetProcessId = (CSRPID)GetProcAddress(ntdll, "CsrGetProcessId");
                NTQSI NtQuerySystemInformation = (NTQSI)GetProcAddress(ntdll, "NtQuerySystemInformation");

                
                DWORD csrss_pid = CsrGetProcessId();
                HANDLE csrss = OpenProcess(PROCESS_DUP_HANDLE, FALSE, csrss_pid);
                if (!csrss)
                {
                        return 0;
                }

                ULONG size = 0x1000;
                SYSTEM_HANDLE_INFORMATION *handles = (SYSTEM_HANDLE_INFORMATION*)malloc(size);
                DWORD status;
                
                        ULONG need;
                        status = NtQuerySystemInformation(SystemHandleInformation, handles, size, &need);
                       if(status!=0)
					   {
                        free(handles);
                        size =need;
                        handles = (SYSTEM_HANDLE_INFORMATION*)malloc(size);
						NtQuerySystemInformation(SystemHandleInformation, handles, size, &need);
						}
				
                
                        int i;

						HANDLE h_proc;

                        for (i=0; i<handles->HandleCount; i++)
                        {
                                if (handles->Handles[i].OwnerPid == csrss_pid)
                                {
                                        if (DuplicateHandle(csrss, (HANDLE)handles->Handles[i].HandleValue, GetCurrentProcess(),
                                                &h_proc, 0, FALSE, DUPLICATE_SAME_ACCESS))
                                        {
                                                if (GetProcessId(h_proc) == pid) 
                                                {
                                                        return h_proc;
                                                }
                                                CloseHandle(h_proc);
                                        }
                                }
                        }
                
                if (handles) free(handles);
                CloseHandle(csrss);
                
        
        return 0;
}



void DebugPriv()
{
HANDLE hToken;
    TOKEN_PRIVILEGES tkp;
    if(OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
    {
        LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tkp.Privileges[0].Luid);
        tkp.PrivilegeCount = 1;
        tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
        AdjustTokenPrivileges(hToken, 0, &tkp, sizeof(tkp), NULL, NULL);
    }
}


void KillApp(DWORD pid)
{
char code[0x20];
memcpy(code,shellcode,0x20);

HMODULE h=GetModuleHandle("NTDLL.DLL");
FARPROC p=GetProcAddress(h,"ZwTerminateProcess");
memcpy((char*)(code+0x0B),(char*)((char*)p+1),4);

	HANDLE hProc=0;
	hProc=OpenProcess(PROCESS_VM_OPERATION|PROCESS_VM_WRITE|PROCESS_CREATE_THREAD, FALSE, pid);
	
if(hProc==0)
{
hProc=OpenProcessFromCsrss(pid);
}
if(hProc==0)
{
OpenProcessFromDebug(pid);
}



    LPVOID hRemoteMem = VirtualAllocEx(hProc, NULL, 0x20, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
 
   





    DWORD numBytesWritten;
    WriteProcessMemory(hProc, hRemoteMem, code, 0x20, &numBytesWritten);
 
   
    HANDLE hRemoteThread = CreateRemoteThread(hProc, NULL, 0, (LPTHREAD_START_ROUTINE)hRemoteMem, 0, 0, NULL);
 
        
    
    CloseHandle(hProc);


}


bool find_pid(std::vector <int> *PIDs,int pid)
{
int i=0;
while(i<PIDs->size())
{
if(PIDs->at(i)==pid)
{
return true;
}
i++;
}
return false;
}


void ProcList()
{
std::vector<int> PIDs;
char buf[260];
PROCESSENTRY32 lppe32;

	
    HANDLE hSnapshot;
   hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    lppe32.dwSize = sizeof(PROCESSENTRY32);
   
    Process32First(hSnapshot, &lppe32);
	     do
        {
		
		printf("%s\t%d\n",lppe32.szExeFile,lppe32.th32ProcessID);
		PIDs.push_back(lppe32.th32ProcessID);
		
		}
        while(Process32Next(hSnapshot, &lppe32));
        CloseHandle(hSnapshot);


		HMODULE ntdll = GetModuleHandle("ntdll");
        
                CSRPID CsrGetProcessId = (CSRPID)GetProcAddress(ntdll, "CsrGetProcessId");
                NTQSI NtQuerySystemInformation = (NTQSI)GetProcAddress(ntdll, "NtQuerySystemInformation");

                
                DWORD csrss_pid = CsrGetProcessId();
                HANDLE csrss = OpenProcess(PROCESS_DUP_HANDLE, FALSE, csrss_pid);
                if (!csrss)
                {
                        return;
                }

                ULONG size = 0x1000;
                SYSTEM_HANDLE_INFORMATION *handles = (SYSTEM_HANDLE_INFORMATION*)malloc(size);
                DWORD status;
                
                        ULONG need;
                        status = NtQuerySystemInformation(SystemHandleInformation, handles, size, &need);
                       if(status!=0)
					   {
                        free(handles);
                        size =need;
                        handles = (SYSTEM_HANDLE_INFORMATION*)malloc(size);
						NtQuerySystemInformation(SystemHandleInformation, handles, size, &need);
						}
				
                
                        int i;

						HANDLE h_proc;

                        for (i=0; i<handles->HandleCount; i++)
                        {
                                if (handles->Handles[i].OwnerPid == csrss_pid)
                                {
                                        if (DuplicateHandle(csrss, (HANDLE)handles->Handles[i].HandleValue, GetCurrentProcess(),
                                                &h_proc, 0, FALSE, DUPLICATE_SAME_ACCESS))
                                        {
                                                DWORD pid=GetProcessId(h_proc);
                                                GetModuleFileNameEx(h_proc,0,buf,260);
												if(find_pid(&PIDs,pid)==0)
												{
													printf("%s(hidden) %d\n",buf,pid);
												}
												CloseHandle(h_proc);

                                        }
                                }
                        }
                
                if (handles) free(handles);
                CloseHandle(csrss);
                
        
    

}


int main(int argc,char** argv)
{
DebugPriv();
if(argc!=2)
{
	printf("usage: %s <pid>\n\n",argv[0]);
	std::vector<int> PID;
ProcList();


	return 0;
}
DWORD pid=atoi(argv[1]);
KillApp(pid);


return 0;
}